PT-2019-18245 · F5 · F5 Big-Iq+3

Published 2019-11-15 · Updated 2019-11-19 · CVE-2019-6663

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions F5 BIG-IP versions 11.5.1 through 15.0.1 F5 BIG-IQ versions 5.2.0 through 7.0.0 F5 iWorkflow version 2.3.0 F5 Enterprise Manager version 3.1.1

Description The configuration utility is susceptible to an Anti DNS Pinning (DNS Rebinding) attack.

Recommendations For F5 BIG-IP versions 11.5.1 through 15.0.1, update the configuration to prevent DNS Rebinding attacks. For F5 BIG-IQ versions 5.2.0 through 7.0.0, restrict access to the configuration utility until a patch is available. For F5 iWorkflow version 2.3.0, consider disabling the vulnerable configuration options as a temporary workaround. For F5 Enterprise Manager version 3.1.1, avoid using the configuration utility until the issue is resolved.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-6663

Affected Products

F5 Big-Ip

F5 Big-Iq

F5 Enterprise Manager

F5 Iworkflow

References · 3

• https://support.f5.com/csp/article/K76052144 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6663 · Security Note
• https://osv.dev/vulnerability/CVE-2019-6663 · Vendor Advisory